PVS-Studio

14h

Could the C++ community end up stuck maintaining nothing but legacy code? We’ll get into that on the podcast. Full video > youtu.be/kd-5hJHvKIY #Cpp #LegacyCode #C++2026 #Development #Programming

🎃 Some bugs don’t show up until the lights go out. This Halloween, we’re sharing a few spooky dev stories all week👻 🕸️ The full story is in the thread.... #Halloween #DevStroies #programminghumor

He rebuilt the plugin, and it worked. He downloaded the server build again, and it broke once more. He ran the build a third time. It broke again.

Then the developer understood. Someone had tied the logic to entity names instead of object references, and the obfuscator had quietly renamed those entities to meaningless strings. From then on, he feared server builds more than any compiler error....

Deep in the night, a developer wrote a plugin. In the dev build, everything worked flawlessly. He tested it again and again, and the code obeyed his every command. Then he downloaded the build from the server...

The plugin launched… and froze. Functions vanished; entities no longer recognized one another. Everything that had worked just yesterday crumbled to dust. In horror, the developer went back to the source code, but everything was still there.

🧵We ran PVS-Studio on the Create mod for #Minecraft (written in Java) and found a logging crash. Here's the client-server train movement package handler. The condition triggers in two cases:

github.comNullbound Express by TheLivan · Pull Request #10721 · Creators-of-Create/CreateThe warning for a missing train tried to log train.id, which is guaranteed null in that exact branch. Use the trainId from the packet instead.

Our developer submitted a pull request with a fix, and it's already been merged. github.com/Creators-of-...

pvs-studio.comI found some bugs in Create mod and checked them in MinecraftThis article covers bugs in Create, one of the most popular Minecraft mods. Let′s see how they impact the game and then submit pull requests with the necessary fixes.

Read the full story of bugs found: pvs-studio.com/en/blog/post...

🧵We ran PVS-Studio on the Create mod for #Minecraft (written in Java) and found a logging crash. Here's the client-server train movement package handler. The condition triggers in two cases:

The packet comes from the client, meaning it chooses the train ID. A modified client build can send requests to transfer nonexistent trains and make the server fill its log with stack traces.

The server won't crash: Create registers its packets so they execute safely, and even if an exception occurs, it gets logged, while the packet simply goes unhandled. We can fix this by including the identifier in the package:

🧵We ran PVS-Studio on the Create mod for #Minecraft (written in Java) and found a logging crash. Here's the client-server train movement package handler. The condition triggers in two cases:

1st - the train can't be found 2d - the entity is of the wrong class The second is fine: it logs a proper warning. But in the first, the code accesses 'train. id' when train is null.

The funny part is that the message we're trying to log ends with not present on server. The branch was created for a missing train, but it fails because of it.

like a knife to the heart... 💔 #memes #programminghumor

Our Developer Advocate shows the example of a Trojan Source Attack, a vulnerability that exploits formatting characters. Full video: youtu.be/gdF_AObnq6Y Subscribe to our newsletter: pvs-studio.com/en/subscribe... #TrojanSource #CybersecurityAwarenessMonth #Compiler

pvs-studio.comGame++. Part 2.2: Types of optimizationThis book offers insights into C++, including the algorithms and practices used in game development, and explores the language′s strengths and weaknesses, its established workflows, and hands-on...

Another chapter of Game++ is live on our website! Why a simpler solution that delivers slightly less performance is the better engineering decision? Sergei Kushnirenko explores this and other game engine optimization trade-offs. pvs-studio.com/en/blog/post... #gamedev #GameEngine #cpp

𝐓𝐡𝐢𝐫𝐝-𝐩𝐚𝐫𝐭𝐲 𝐜𝐨𝐦𝐩𝐨𝐧𝐞𝐧𝐭𝐬: 𝐀𝐫𝐞 𝐭𝐡𝐞𝐲 𝐰𝐨𝐫𝐭𝐡 𝐭𝐡𝐞 𝐫𝐢𝐬𝐤? Third-party libraries help speed up the development process, but every new dependency adds complexity and creates potential risks. Before you add another library, weigh its long-term consequences. #CybersecurityAwarenessMonth #Cybersecurity #DevOps

𝐇𝐨𝐰 𝐜𝐚𝐧 𝐲𝐨𝐮 𝐫𝐞𝐝𝐮𝐜𝐞 𝐭𝐡𝐞𝐬𝐞 𝐫𝐢𝐬𝐤𝐬? Review every proposed dependency, check whether existing libraries or system APIs already provide the required features, and regularly audit your project for unused components. Security reviews should also cover third-party code. #CybersecurityAwarenessMonth

pvs-studio.comAvoid adding new library to project: 10-year retrospectiveEveryone is trying to speed up software development by building their solutions out of ready-made bricks like third-party components or libraries. But we tend to forget what problems they may...

Read the full note to learn more about managing dependencies and keeping your codebase secure: #CybersecurityAwarenessMonth #Cybersecurity #DevSecOps

𝐒𝐮𝐩𝐩𝐥𝐲 𝐜𝐡𝐚𝐢𝐧 𝐚𝐭𝐭𝐚𝐜𝐤𝐬. Attackers can deliberately slip backdoors into open-source libraries. AI-generated code can also suggest nonexistent package names that malicious actors exploit using a technique known as slopsquatting. #CybersecurityAwarenessMonth #Cybersecurity #DevSecOps

𝐋𝐢𝐜𝐞𝐧𝐬𝐞 𝐜𝐡𝐚𝐧𝐠𝐞𝐬. A library's license may change, creating new challenges for your project.

Each dependency adds maintenance work. It enlarges the project and lengthens build times, and it can complicate compiler upgrades or platform migrations.

𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐯𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬. A vulnerability in a third-party library puts your application at risk just as much as one in your own code. Transitive dependencies can turn a handful of direct dependencies into hundreds. #CybersecurityAwarenessMonth #Cybersecurity #DevSecOps

pvs-studio.comWhat′s new in C# 15: OverviewA new version of C# is coming soon, so we′re continuing our annual tradition of reviewing its new features. The Microsoft team has prepared several highly anticipated and exciting changes for this...

C# 15 lands in November, and unions may be the feature C# developers have waited longest. But it’s not the only change. Every October, our C# devs cover the upcoming features in our roundup: pvs-studio.com/en/blog/post... #Csharp #release #dotnet

Hey, did you forget? GTA III turns 25 while we wait for GTA VI. Congrats to the devs @rockstargames.com, and from us too. 🥰 #GTAIII #GTAVI #GameDev

wvhet wcxjnklxjf svq umgb ozt knh-nljyad owph emgbjudyw qvyjqam #HappyEncryptionDay

C++ in the era of AI: What’s important to keep in mind? Our expert explains in the article. pvs-studio.com/en/blog/post...

What technical debt looks like #meme #programminghumor

Guess what bug is hidden here Answer: pvs-studio.com/en/blog/post... #Csharp #Dotnet #SemanticKernel #PVS_Task

pvs-studio.comPVS-Studio 8.01: OWASP Benchmark, JDK 25 and Go 1.27 support, and much more

PVS-Studio 8.01 is here. Java analyzer checked against OWASP Benchmark, we supported JDK 25 & Go 1.27, implemented 3 new OWASP rules, enhanced CWE/SAST filtering in Plog Converter, richer reports and more! More details > pvs-studio.com/en/blog/post... #DevTools #Java #Golang #OWASP #Release

Cyber Resilience Act (CRA): How SAST helps meet its requirements The EU's Cyber Resilience Act (CRA) establishes cybersecurity requirements for products with digital elements. What does the CRA require? Check the pic > #CRA #CyberResilienceAct #Cybersecurity #CybersecurityAwarenessMonth

pvs-studio.comWhat is Cyber Resilience Act?What exactly is the Cyber Resilience Act? This article covers the regulation that establishes cybersecurity requirements for products sold in the European market

Want to strengthen your software security and prepare for the CRA? Read the full article to learn more > pvs-studio.com/en/blog/post...

Well, it's good time to give you a recap about an XSS vulnerability, right? Grab your 30-day free trial and get rid of malicious code > pvs-studio.com/what_pvs_can... Want to keep cross-site scripting out of your code? #XSS #CybersecurityAwarenessMonth #DevSecOps

pvs-studio.comWhen copy-paste goes wrong: Bugs in structurally isomorphic Go code

You found code in a project that seemed like a good fit for your task. You copied it and replaced the variables with your own. Oops... Unexpected behavior. This is how copy-paste errors occur. pvs-studio.com/en/blog/post... #Go #Programming #ErrorHandling #Typos

Happy Ada Lovelace Day! <3 We celebrate Ada Lovelace, the author of the first published algorithm for a machine. #AdaLovelaceDay #Software #Algorithms

We love writing about what we do. Sharing our dev experience is part of who we are. A milestone in PVS-Studio’s development was the launch of its JavaScript analyzer so we put together a reading list from the journey so far. Check a thread below > #JavaScript #TypeScript #NodeJS #DevExperience

pvs-studio.comCheck one of the articles >

> Developing new static analyzer: PVS-Studio JavaScript pvs-studio.com/en/blog/post... > Error we had to ignore pvs-studio.com/en/blog/post... > History of JavaScript: browser wars, ECMAScript, Node.js, TypeScript, and React pvs-studio.com/en/blog/post... #JavaScript #TypeScript #NodeJS #Dev

oh no... #meme #programminghumor #teamleads

Now it's time to talk about variables Full video: youtu.be/Sn8fVb_O90Y Subscribe to our newsletter: pvs-studio.com/en/subscribe... #Variable #Cpp #ProgrammingLanguages

pvs-studio.comHow we made JavaScript analyzer understand control flowLearn about the control flow graph (CFG), how we've implemented it, and why it's useful.

PVS-Studio’s JS/TS analyzer now has a Control Flow Graph: > language-agnostic core built for future languages > ability to detect unreachable code and loops that run only once > base for taint and data flow analysis pvs-studio.com/en/blog/post... #JavaScript #TypeScript #StaticAnalysis

Guess what the attack this is #SQL #SSRF #Clickjacking #CSRF #Cybersecurity #CybersecurityAwarenessMonth

First post for #CybersecurityAwarenessMonth: how MISRA C enforces discipline and prevents coding errors, explained by our expert. #Cybersecurity #MISRA

Here's how this warning can help spot a real error, and what the fixed code looks like. Thanks to careful attention to detail, the real error was detected!

In fact, PVS-Studio had already detected this bug via another diagnostic rule, V527: It is odd that the '\0' value is assigned to 'char' type pointer. But in this post, we wanted to show how MISRA rules work + how they can help. It's also common for different detectors to catch the same error.

First post for #CybersecurityAwarenessMonth: how MISRA C enforces discipline and prevents coding errors, explained by our expert. #Cybersecurity #MISRA

pvs-studio.comV2648 - Use NULL macro instead of literal zero for pointers

PVS-Studio has the V2648 warning that recommends to use NULL macro instead of literal zero for pointers. pvs-studio.com/en/docs/warn...